Travel payments glossary

CVC (Card Verification Code)

A short security code printed on a card that is checked during card-not-present payments.

Plain-English definition

A Card Verification Code (CVC), also called CVV, CV2 or CID depending on the scheme, is the short security code printed on a payment card — three digits on Visa and Mastercard, four on American Express. It is not stored on the magnetic stripe or chip and is intended to demonstrate that the cardholder has physical possession of the card during a card-not-present transaction. Merchants are not allowed to store CVC values under PCI DSS.

Why it matters in travel

In travel, CVC is the front-line check during phone bookings, agent payments and online checkouts where the card is not physically present. A clean CVC match is one of the strongest non-authentication signals that the payer has the card in hand, which matters when committing against a non-refundable supplier booking.

Storing CVC values would be a fast route to a PCI DSS failure, so the rule is simple: collect it, send it for authorisation, never write it down. That single discipline drives a lot of operational design — agent screens that mask the field, call recordings that pause during entry, training that drills the point until it becomes muscle memory.

A CVC mismatch on a high-value travel booking is not just a decline; it is a signal worth investigating. It can mean a fat-fingered customer, a card recently reissued, or it can mean a card being tested against a stolen number. The teams that pay attention to CVC outcomes catch fraud waves earlier and avoid the chargebacks that would have landed weeks later.

How felloh helps

felloh records CVC, AVS and authentication results alongside the booking trail so risk and finance teams can see the verification picture against every payment without holding any of the values themselves.

Connect the dots.

See how payments, settlement, refunds and reporting evidence connect around every booking.